Feedback on EDPB Guidelines 
06/2020 


on the interplay of the Second Payment Services Directive 
and the GDPR, Version 1.0, Adopted on 17 July 2020 for 
public consultation 


I welcome the proposed guidelines and in particular the conclusion that silent party data can not be 
used for any purpose other than the one the data subject provided the data for. Still, I am concerned that 
processing of data will remain significantly invisible and impossible to trace and verify for data 
subjects unless the guidelines provide more concrete guidance on the way the rights of the data subject 
are to be applied to silent party data. 


In particular, I am concerned that TPPs will apply the exception in GDPR article 14.5b so broadly as to 
make article 14 effectively meaningless. Of course there will be cases where a TPP will really be 
unable to identify the data subject. But if the market develops similar to for instance the UPI market in 
India and becomes dominated by a single tech giant’, that party will be able to identify the silent party 
in most cases for the simple reason the silent party is also a customer with a known IBAN. 

The guidelines should make it clear that TPPs are expected to make every effort to identify and inform 
the silent party in accordance with article 14.1-3. 


Additionally, I am concerned about the way data subjects can identify themselves to a TPP in order to 
ask access to all their data (including the data that is processed as silent party data) in accordance with 
GDPR article 15. Data subjects should be able to get access to that by proving control over an IBAN, 
which is commonly done by making a payment of EUR 0.01. As this would obviously conflict with the 
requirement that data access is free, more guidance on how a data subject can prove his identity would 
be welcome. 


1 https://www-statista.com/statistics/1034443/india-upi-usage-by-platform/ 


